Leader of Online Carding Forums Sentenced in Mississippi

In June, 2014, Homeland Security Investigations in Mississippi began an investigation into Milad Kalantari, an Iranian citizen. Throughout the course of the investigation, HSI learned that Kalantari ran an “international fraud organization.” More specifically, they learned that the 32-year-old Iranian ran multiple websites that sold stolen credit card information. After a multi-year provided, the case closed on March 9, 2017, when U.S. District Judge Louis Guirola Jr sentenced Kalantari to 120 months in federal prison.

Judge Louis Guirola Jr of the Southern District of Mississippi convicted Kalantari of crimes that warranted two sentences. For the first charge, access device fraud, the district judge ordered a 120-month sentence. And the second charge(s), conspiracy to commit identity theft and access device fraud, the district judge ordered a 60-month sentence. Both served concurrently. He also ordered Kalantari pay $36.6 million in restitution.

He fell under investigation during a larger investigation into the Yahoo Boys, a West African criminal organization. According to an investigating agent, “the Yahoo Boys use international hackers and underground Iranian, Russian and Vietnamese groups to conduct financial fraud schemes.” In addition to the websites where Kalantari sold financial information, he ran underground carding forums, the agent explained. The U.S. then indicted the Iranian in a 16-count indictment.

On December 21, 2015, Kalantari landed in the United States at the John F. Kennedy International Airport in Queens, New York. He knew nothing of the indictment and entered the country of his free will. Federal agents from three states arrested him at the airport upon touchdown. In a previous Yahoo chat with a co-conspirator, an undercover federal agent learned that Kalantari claimed he won a U.S. visa. The co-conspirator unknowingly told an undercover federal agent that the then-suspect planned to move to the U.S.

Since the 1990s, the U.S. hosted the United States Diversified State Lottery. Non-U.S. citizens “won” visas in the so-called “green card lottery.” The agent, according to the affidavit, checked with the U.S. Embassy in Ankara, Turkey, and learned that Kalantari indeed ”won” a U.S. visa. The embassy, and State Department confirmed Kalantari’s schedule and plans—law enforcement knew when and where the Iranian planned on entering the U.S.

HSI investigators linked Kalantari to the financial crimes after they conducted a search of his electronic devices. The Iranian’s email gave him away. He contacted his sister who attended college in the United States on a student visa. One email he sent to his sister included his bank information in Iran and home address in Sari, Mazandaran. They also discovered evidence that connected Kalantari to several of the online carding websites and stolen credit cards themselves.

On October​ 6, 2016, Kalantari pleaded guilty to conspiracy to commit identity theft and access device fraud. Along with the first two charges, he also pleaded guilty to one count of substantive access device fraud. In this case, substantive access device fraud referred both to the damage he caused the victims and the criminal intent behind the device fraud.

Court documents revealed that federal agents made purchases on Kalantari’s carding forums. In three purchases, agents reported that they received stolen credit card information from 68 victims in Mississippi. Among the thousands of individual victims, Keesler Federal Credit Union and Coastal Bank and Trust also reported great losses. Additionally, “one woman’s card number was used four times for $100 each at a Dunkin Donuts.”

“Kalantari sold approximately 2.5 million stolen credit cards on his websites, with an intended loss amount valued at over $1.2 billion,” the press release announced. “More than $35 million in actual losses have been confirmed with U.S. companies including more than $26 million in losses to Discover Card and almost $5 million in losses to American Express.”

The federal case appeared only in Mississippi. Kalantari will likely serve only 120 months and pay $36.6 million in restitution; some of his crimes allowed other states a chance at prosecution as well. The U.S. cracked down on online financial crimes this year. In February, 2017, a member of an international cybercrime group that caused $71m in damage received a 48-month prison sentence.